@openwop/spec-artifacts 2.0.0-rc.0

package/api/v2/redocly.yaml

@@ -0,0 +1,16 @@
+extends:
+  - recommended
+
+rules:
+  # Same two suppressions as api/redocly.yaml, for the same reasons: the
+  # discovery endpoints (`/.well-known/openwop`, `/openapi.json`, `/host/events`)
+  # are unauthenticated and take no input; and Redocly's
+  # no-required-schema-properties-undefined does not walk to parent scope on the
+  # JSON Schema 2020-12 if/then conditional-requirement idiom — in v2 that idiom
+  # is GENERATED (schemas/v2/capabilities.schema.json status ⇒ until, from
+  # spec/v2/declaration.json), which is what RFC 0178's acceptance line asked for
+  # before re-enabling; the rule still false-positives on every generated site,
+  # so it stays off with scripts/check-required-properties-defined.mjs as the
+  # compensating control. Recorded against RFC 0178's acceptance at the RC.
+  operation-4xx-response: off
+  no-required-schema-properties-undefined: off

package/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@openwop/spec-artifacts",
+  "version": "2.0.0-rc.0",
+  "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
+  "license": "Apache-2.0",
+  "repository": { "type": "git", "url": "git+https://github.com/openwop/openwop.git", "directory": "spec-artifacts" },
+  "files": ["api", "schemas", "spec", "CORPUS-STAMP.json", "README.md", "LICENSE"],
+  "sideEffects": false,
+  "publishConfig": { "access": "public" }
+}

package/schemas/README.md

@@ -0,0 +1,144 @@
+# OpenWOP Spec v1 — JSON Schemas
+
+> **Status: FINAL v1 (2026-05-10).** Per-row RFC status words are checked against `RFCS/` by `scripts/check-rfc-status-coherence.mjs` (RFC 0178 §E.1); the column is generated in Phase 3. Hand-authored from prose specs. JSON Schema 2020-12. Validate with Ajv2020 (`require('ajv/dist/2020')`), `python-jsonschema`, or any other 2020-12 implementation. Implementations MAY pin to these schemas; servers MUST accept any JSON document that validates against them.
+
+| Schema | Source spec | Coverage |
+|---|---|---|
+| `agent-inventory-response.schema.json` | `node-packs.md` + RFC 0072 | RFC 0072 §A — read projection of installed manifest agents (`GET /v1/agents` body + `$defs.AgentInventoryEntry`); no system prompt / handoff schemas / credentials (SR-1) |
+| `agent-deployment.schema.json` | `agent-deployment.md` (RFC 0082) | Per-(agentId, version) deployment record — the seven-state lifecycle (draft/test/staged/active/paused/deprecated/rolled-back) + canaryPercent + rollbackPointer + channels[]; host-runtime state distinct from the immutable manifest and the registry's published tags |
+| `agent-deployment-transition.schema.json` | `agent-deployment.md` §E (RFC 0082) | The `POST /v1/agents/{agentId}/deployments` request body — a state-transition request (promote/pause/deprecate/rollback/adjust-canary + toState/channel/canaryPercent/evalRunId), authorized fail-closed + gate-enforced before emitting the matching `deployment.*` event |
+| `agent-eval-suite.schema.json` | `agent-evaluation.md` (RFC 0081) | Portable agent evaluation suite — tasks + golden/rubric `expected` + deterministic fixtures + allowed model classes + pass/fail thresholds, pack-distributed via `evalSuiteRef` |
+| `agent-manifest.schema.json` | `node-packs.md` + agent-pack RFCs | Agent manifest entries distributed alongside node-pack manifests |
+| `eval-summary.schema.json` | `agent-evaluation.md` (RFC 0081) | The content-free eval-run scorecard — aggregate + per-task scores/cost/latency/safety-findings + regression delta; served by `GET /v1/runs/{runId}/eval-summary` (SECURITY invariant `eval-summary-no-content-leak`) |
+| `proposal.schema.json` | `agent-memory.md` §"Reviewable learning" (RFC 0096) | Reviewable-learning proposal — an INERT, draft-state reusable artifact (agent-pack/workflow-chain-pack/prompt-template/automation) synthesized from run traces; MUST NOT influence any run until `applied`; activation delegated to RFC 0051/0049 (SECURITY invariants `proposal-inert-until-applied`, `proposal-no-resynthesis`) |
+| `goal.schema.json` | `agent-runtime.md` §"Standing goals" (RFC 0097) | Standing goal — a durable objective with judge-based (RFC 0090) completion + bounded (RFC 0058) continuation; completion is the judge's verdict, never client-set (SECURITY invariants `goal-continuation-bounded`, `goal-completion-judge-only`) |
+| `localized-content-section.schema.json` | `localized-content.md` §B (RFC 0103) | One section record — base `data` + sparse `localizations` map (BCP-47 keys, never the base locale); resolved by the per-section field merge (exact→family→base, §C); body shapes open/host-defined |
+| `localized-content-page.schema.json` | `localized-content.md` §B (RFC 0103) | Content page — `slug` + `sectionOrder` + `status` (atomic across locales for v1) + SEO hreflang/og:locale alternates |
+| `localized-content-language-settings.schema.json` | `localized-content.md` §B (RFC 0103) | Per-tenant authoring config — `baseLocale` + `supportedLocales` (base ∉ supported) + `autoTranslateOnPublish`; source of truth for the advertised `content` capability |
+| `localized-content-page-response.schema.json` | `localized-content.md` §D (RFC 0103) | Resolved delivery response for `GET /v1/content/pages/{slug}` — negotiated `locale` (= `Content-Language`) + already-merged, published-only sections in render order (SECURITY invariants `content-published-cache-no-draft`, `content-response-tenant-scoped`, `content-no-cross-tenant-enumeration`) |
+| `export-bundle.schema.json` | `portability.md` (RFC 0098) | Portable agent-platform export bundle — a tenant's reusable estate (agents/packs/templates/connection-refs/schedules/roster/org-chart) for cross-host migration; carries NO credential values, only refs (SECURITY invariant `export-bundle-no-credential-material`) |
+| `agent-ref.schema.json` | `agent-memory.md` + agent-identity RFC | Multi-Agent Shift Phase 1 — slim runtime AgentRef projection carried on `RunSnapshot.agent` / `runOrchestrator`, `WorkflowNode.agent?`, and `agent.*` event payloads |
+| `agent-roster-entry.schema.json` | `agent-roster.md` (RFC 0086) | Standing agent INSTANCE — a named, tenant-scoped `host:<id>` agent (the "digital-twin employee") that references a manifest/deployment (`agentRef`) and owns a `workflows[]` portfolio; the discovery shape behind `GET /v1/agents/roster` + the `roster` inventory projection |
+| `agent-org-chart.schema.json` | `agent-org-chart.md` (RFC 0087) | Tenant-scoped, DESCRIPTIVE grouping of roster members into departments + roles with acyclic `reportsTo` edges; carries NO authority field (every object `additionalProperties:false`) per the `org-position-no-authority-escalation` invariant; the discovery shape behind `GET /v1/agents/org-chart` |
+| `agent-roster-response.schema.json` | `agent-roster.md` (RFC 0086 §B) | Response body for `GET /v1/agents/roster` — `{ roster: AgentRosterEntry[], total }`, tenant-scoped |
+| `org-chart-responsibility-view.schema.json` | `agent-org-chart.md` (RFC 0087 §D) | Response body for `GET /v1/agents/org-chart/{departmentId}` — the department subtree + the responsibility roll-up (union of member portfolios) |
+| `ai-envelope.schema.json` | `ai-envelope.md` | FINAL v1.1 — inbound LLM-emission envelope. Top-level shape (`type` / `schemaVersion` / `envelopeId` / `correlationId` / `payload` / `meta` / `partial`). Per-kind payload schemas under `envelopes/`. Distinct from `RunEventDoc` (outbound) and `error-envelope.schema.json` (host HTTP errors). |
+| `artifact-type-pack-manifest.schema.json` | `artifact-type-packs.md` + RFC 0071 | RFC 0071 (`Accepted`) — manifest for `kind: "artifact-type"` registry packs. Peer to `node-pack-manifest.schema.json` (RFC 0003), `workflow-chain-pack-manifest.schema.json` (RFC 0013), and `prompt-pack-manifest.schema.json` (RFC 0028); disjoint via the `kind` discriminator. Distributes typed artifact definitions (schema + advisory rendering hint + lifecycle + export-format hints) via the same signed-tarball + Ed25519 + SRI pipeline. |
+| `envelopes/clarification.request.schema.json` | `ai-envelope.md` §"Universal kinds" | FINAL v1.1 — payload for the universal `clarification.request` kind; engine lifts to `kind: "clarification"` `InterruptPayload`. |
+| `envelopes/schema.request.schema.json` | `ai-envelope.md` §"Universal kinds" | FINAL v1.1 — LLM asks the engine for a kind's JSON Schema. Counts against `Capabilities.limits.schemaRounds`. |
+| `envelopes/schema.response.schema.json` | `ai-envelope.md` §"Universal kinds" | FINAL v1.1 — side-channel ack for `schema.request`. Never surfaces to users. |
+| `envelopes/error.schema.json` | `ai-envelope.md` §"Universal kinds" | FINAL v1.1 — LLM's deliberate error report. Distinct from `error-envelope.schema.json` (host HTTP errors). |
+| `envelopes/media.image.schema.json` | `ai-envelope.md` §"Media reference payloads" | RFC 0055 §C — optional `media.image` payload; tenant-scoped URL ref or inline base64 below `maxInlineMediaBytes`. |
+| `envelopes/media.audio.schema.json` | `ai-envelope.md` §"Media reference payloads" | RFC 0055 §C — optional `media.audio` payload; URL ref or inline base64 + optional `durationSeconds`. |
+| `envelopes/media.file.schema.json` | `ai-envelope.md` §"Media reference payloads" | RFC 0055 §C — optional `media.file` payload; downloadable asset by URL ref or inline base64 + optional `name`. |
+| `envelopes/ui.a2ui-surface.schema.json` | `ai-envelope.md` §"A2UI surfaces" | RFC 0102 — optional, advertised `ui.a2ui-surface` payload; closed A2UI component tree (`anyOf` + single-string-enum discriminator) + host-enumerated `catalogVersion`. Core `ui.*` content-primitive family beside `media.*`. |
+| `a2ui-surface-delta-frame.schema.json` | `ai-envelope.md` §"Delta transport" + `stream-modes.md` | RFC 0114 (`Accepted`) — host-side TRANSPORT frame (`{ surfaceRef, catalogVersion, patch[] }`) carrying an RFC 6902 (JSON-Patch) delta over a recorded `ui.a2ui-surface` envelope; stream-only (`?a2uiDelta=1`), NOT a recorded shape (the envelope stays full). Op enum excludes `test`. Consumer re-validates the post-patch surface against the closed catalog fail-closed. |
+| `annotation.schema.json` | `RFCS/0056` + `observability.md` | RFC 0056 (`Accepted`) — a non-blocking human/agent quality signal (rating / correction / label / flag) attached to a run, event, or node. A side-resource (not a replayable run-event-log entry); response of `POST/GET /v1/runs/{runId}/annotations` + payload of the `run.annotated` SSE notification. |
+| `annotation-create.schema.json` | `RFCS/0056` | RFC 0056 (`Accepted`) — request body for `POST /v1/runs/{runId}/annotations` (host assigns `annotationId`/`createdAt`/`actor`; binds `target.runId` to the path). |
+| `heartbeat-evaluated.schema.json` | `RFCS/0060` + `host-capabilities.md` | RFC 0060 (`Accepted`) — payload of the heartbeat-scoped `heartbeat.evaluated` AsyncAPI event (`{ heartbeatId, status, changed }`); emitted every tick by a host advertising `capabilities.heartbeat`. Not a run-event-log entry. |
+| `heartbeat-state-changed.schema.json` | `RFCS/0060` + `host-capabilities.md` | RFC 0060 (`Accepted`) — payload of the `heartbeat.stateChanged` AsyncAPI event (`{ heartbeatId, from, to }`); emitted only on a predicate-state transition. Not a run-event-log entry. |
+| `audit-verify-result.schema.json` | `auth-profiles.md` §`openwop-audit-log-integrity` | Response payload from `GET /v1/audit/verify` — chain-validity verdict + checkpoints + anomalies |
+| `capabilities.schema.json` | `capabilities.md` | `/.well-known/openwop` response — protocolVersion + supportedEnvelopes + schemaVersions + limits + optional v1 discovery surface |
+| `channel-written-payload.schema.json` | `channels-and-reducers.md` §Channel write event | Payload of the `channel.written` RunEvent — write input + reducer name |
+| `channel-presence-payload.schema.json` | RFC 0110 | Payload of the OPTIONAL `channel.presence` RunEvent — ephemeral channel presence (online + typing), membership-gated, non-persisted |
+| `chat-card-pack-manifest.schema.json` | `chat-card-packs.md` + RFC 0071 | DRAFT — manifest for `kind: "card"` registry packs (RFC 0071 Phase 2). Peer to the node/workflow-chain/prompt/artifact-type pack manifests; disjoint via the `kind` discriminator. Distributes AI chat cards: a prompt template + typed input subset bound to a typed `outputArtifactType`. |
+| `form-content-pack-manifest.schema.json` | `form-content-packs.md` + RFC 0137 | DRAFT — manifest for `kind: "form-content"` registry packs (RFC 0137). Peer to the node/workflow-chain/prompt/artifact-type/chat-card pack manifests; disjoint via the `kind` discriminator. Distributes form templates: a versioned, ordered list of typed fields a host instantiates through its normal create path. `fields[].type` reuses the RFC 0071 portable subset verbatim rather than defining a second vocabulary. |
+| `connection-pack-manifest.schema.json` | `connection-packs.md` + RFC 0095 | DRAFT — manifest for `kind: "connection"` registry packs (RFC 0095). Peer to the node/workflow-chain/prompt/artifact-type/chat-card pack manifests; disjoint via the `kind` discriminator. Distributes a portable provider definition — auth endpoints, read/write scope groups, exactly-one reach (`mcp`/`openapi`/`integration`) — that the RFC 0045/0047 `provider` string resolves against. Carries NO credential material (`connection-pack-no-credential-material`). |
+| `frontend-plugin-manifest.schema.json` | `frontend-plugin-packs.md` + RFC 0117 | DRAFT — manifest for `kind: "frontend-plugin"` registry packs (RFC 0117). Peer to the other pack manifests; disjoint via the `kind` discriminator. Distributes a signed, SANDBOXED UI extension — one or more `uiPlugins[]` (a `pluginId`, a `surface`, an opaque `entry` bundle, a closed `hostApi` allowlist). A backend `runtime` member is FORBIDDEN (`not: {}`). Loaded only in a cross-origin sandbox (`frontend-plugin-isolation`). |
+| `ui-plugin-message.schema.json` | `frontend-plugin-packs.md` + RFC 0117 | DRAFT — the `ui-plugin/1` `postMessage` host-RPC envelope (RFC 0117) between a sandboxed front-end plugin and its host: a plugin→host `request` (closed `method` allowlist), a host→plugin `response` (`ok`+`result` or `ok:false`+`error`), or a host→plugin `event`. Carries the optimistic-concurrency `version` token and the `artifact_conflict` + `currentVersion` shape (`frontend-plugin-rpc-allowlist` / `frontend-plugin-no-byok`). |
+| `conformance-certification-bundle.schema.json` | `conformance-certification.md` + RFC 0089 | **DEPRECATED** (RFC 0148; `--certify` defaults to bundle v2 since suite 1.152.0; v1 ceases to substantiate a new certification after 2026-11-10; removal scheduled for v2.0 per `spec/v1/deprecations.json`) — machine-readable attestation binding a host's claimed profiles to the reproducible run that substantiates them (suite version + per-scenario pass list + host identity/commit + captured discovery document). Out-of-band; a consumer re-derives each claim via the §B binding rule. |
+| `conversation-event.schema.json` | `channels-and-reducers.md` + conversation RFC | Multi-turn conversation event shape for orchestrator-driven HITL flows |
+| `conversation-turn.schema.json` | `channels-and-reducers.md` + conversation RFC | Conversation turn shape for user/agent/system messages |
+| `core-conformance-mock-agent-config.schema.json` | `node-packs.md` + RFC 0023 | Config shape for the conformance-only `core.conformance.mock-agent` typeId — drives `agent.*` event emission on cue (`mockReasoning` / `mockToolCalls` / `mockHandoff` / `mockDecision` / `mockConfidence`). Hosts MUST refuse this typeId for production tenants unless `capabilities.conformance.mockAgent` is advertised. |
+| `credential-reference.schema.json` | `host-capabilities.md` §host.credentials + RFC 0046 | Opaque `{ ref, scope }` handle to a host-stored credential — the only credential artifact on the wire; never carries key material |
+| `debug-bundle.schema.json` | `debug-bundle.md` | Portable run diagnostic export from `GET /v1/runs/{runId}/debug-bundle` |
+| `dispatch-config.schema.json` | `node-packs.md` + dispatch RFC | Configuration shape for `core.dispatch` / sub-workflow routing |
+| `error-envelope.schema.json` | `rest-endpoints.md` + `auth.md` | Canonical `{error, message, details?}` shape returned on every non-2xx |
+| `memory-entry.schema.json` | memory-layer RFC | Persisted agent memory entry shape |
+| `memory-list-options.schema.json` | memory-layer RFC | Query options for listing agent memory entries |
+| `node-pack-manifest.schema.json` | `node-packs.md` | Pack manifest (`pack.json`) — name, version, engines, nodes[], runtime, signing |
+| `pack-lockfile.schema.json` | `node-packs.md` §"Dependency resolution + lockfile" | Reproducible-build lockfile pinning resolved pack versions + SHA-256 integrity + Ed25519 signature for the entire workspace dependency graph |
+| `prompt-kind.schema.json` | `prompts.md` + RFC 0027 | Shared `string` enum (`system` / `user` / `few-shot` / `schema-hint`) `$ref`-ed by every schema that names a prompt kind. Single edit point when introducing a new kind. |
+| `prompt-pack-manifest.schema.json` | `prompts.md` §"Discovery & distribution" + RFC 0028 | Manifest for `kind: "prompt"` registry packs. Peer to `node-pack-manifest.schema.json` (RFC 0003) and `workflow-chain-pack-manifest.schema.json` (RFC 0013); disjoint via the `kind` discriminator. Distributes curated PromptTemplate collections via the same signed-tarball + Ed25519 + SRI pipeline. |
+| `prompt-ref.schema.json` | `prompts.md` + RFC 0027 | Reference to a PromptTemplate. `oneOf` accepts the stringy form (`prompt:templateId@version`) or a structured object with `libraryId` / `templateId` / `version` / `variableOverrides`. |
+| `prompt-template.schema.json` | `prompts.md` + RFC 0027 | Named, versioned, variable-bound prompt body. Carries `templateId` + SemVer `version` + `kind` (via `prompt-kind.schema.json`) + Mustache `text` + typed `variables[]` + optional `modelHints` + `meta` provenance (incl. RFC 0028 `packName` + `packVersion` when pack-sourced). |
+| `registry-version-manifest.schema.json` | `registry-operations.md` | Registry-augmented version manifest served at `GET /v1/packs/{name}/-/{version}.json`. Extends the bare pack-manifest contract with registry-side metadata (integrity hash, signing-block polymorphism, lifecycle flags). Enforced by the `Validate version manifests against registry-version-manifest schema` step in `.github/workflows/registry-publish.yml`. |
+| `orchestrator-decision.schema.json` | `node-packs.md` + orchestrator RFC | Decision output shape for orchestrator routing nodes |
+| `run-ancestry-response.schema.json` | `multi-agent-execution.md` + RFC 0040 | Response body for `GET /v1/runs/{runId}/ancestry` — names the run's immediate parent in the cross-host composition chain (or `parent: null` for top-level runs). Capability-gated on `capabilities.multiAgent.executionModel.crossHostCausation.ancestryEndpointSupported`. |
+| `run-diff-response.schema.json` | `rest-endpoints.md` + RFC 0054 | Response body for `GET /v1/runs/{runId}:diff?against={otherRunId}` — deterministic, replay-aware structured diff of two runs (`divergedAtSeq` + `eventDiffs[]` + `stateDiff`). |
+| `run-event-payloads.schema.json` | `run-event.schema.json` §RunEventType | Per-RunEventType payload contracts, indexed by `$defs.<typeId>` for opt-in strict validation |
+| `run-event.schema.json` | `version-negotiation.md` + `RunEventDoc` | Event log envelope + event type enum |
+| `run-options.schema.json` | `run-options.md` | Per-run input overlay (configurable + tags + metadata) on `POST /v1/runs` |
+| `run-orchestrator-decided-event.schema.json` | orchestrator RFC + `observability.md` | Event payload for orchestrator decisions |
+| `run-snapshot.schema.json` | `rest-endpoints.md` §RunSnapshot | Projected run state from `GET /v1/runs/{runId}` |
+| `subject.schema.json` | `auth.md` §"The Subject record" + RFC 0165 | DRAFT — issuer-scoped, lane-typed identity record carried as `owner.subject` on `RunSnapshot` and the `run.started` echo; opaque `subjectId` (no `@`/whitespace), `keyClass` iff saml/scim, optional bounded `actor` chain. Optional in v1.x; the v2 major requires it. |
+| `residency.schema.json` | RFC 0129 + `capabilities.md` §dataResidency | OPTIONAL data-residency `{region}` constraint on `POST /v1/runs` (honor-or-reject admission) |
+| `credential-provenance.schema.json` | `host-capabilities.md` §"Credential provenance + egress policy" (RFC 0079) | Metadata about a host-issued credential at the tool/egress boundary — `credentialId`/`issuer`/`audiences`(+scopes/expiry/redaction/audit-correlation). Secret-free (SR-1); the §C audience-binding MUST is evaluated against `audiences`. |
+| `security-advisory.schema.json` | `registry-operations.md` + INCIDENT-RESPONSE runbook | Registry-owned CVE advisory record at `registry/security/advisories.json`. One entry per disclosed vulnerability — id, severity, affected pack-name + SemVer range, optional fixedIn/advisoryUrl/credits. Enforced by `check-advisories.mjs` in `.github/workflows/registry-publish.yml`. |
+| `trigger-subscription.schema.json` | `trigger-bridge.md` (RFC 0083) | Durable inbound-trigger subscription record — `subscriptionId`/`source`/`state` (active/paused/failed/dead-lettered) + `dedupEnabled`/`retryPolicy` + the webhooks.md register keys. Backs the `openwop-trigger-bridge` profile; content-free of inbound payloads (SR-1). |
+| `trigger-event.schema.json` | `trigger-bridge.md` §F (RFC 0099) | The normalized external-event envelope handed to a started run as `ctx.triggerData` (webhook/email/form). In-run only — never event-logged; `trigger.delivery.attempted` stays content-free. Per-source one-of; `contentTrust: "untrusted"`; `AttachmentRef.ref` is a host-internal handle, never a fetchable URL (`trigger-ingestion-ssrf` / `trigger-ingestion-content-redaction`). |
+| `trigger-subscription-registration.schema.json` | `trigger-bridge.md` §F (RFC 0099) | The `POST /v1/trigger-subscriptions` create request — binds an external `source` to a `workflowId` with a dedup config + a source-authenticity `verification` policy. The portable create surface RFC 0083 UQ1 left per-source. |
+| `a2a-task-state.schema.json` | `a2a-integration.md` §"Async / durable Tasks" (RFC 0100) | The durable, persisted projection of an A2A `Task` an OpenWOP host keeps per backing run when `a2a.durableTasks: true` — `taskId == runId`, lowercase-hyphen `state`, `interruptKind`, optional SSRF-guarded `PushConfig`. Content-free of run inputs/outputs/artifacts (SR-1 / `a2a-push-egress-ssrf`). |
+| `self-hosted-runner-dispatch-frame.schema.json` | `self-hosted-runner.md` (RFC 0122) | DRAFT — one model/tool dispatch STEP the host routes to a registered runner over the runner↔host channel: `{runId, stepId, seq, kind, provider?/model?/tool?, inputs}`. `seq` is the per-runner monotonic dispatch cursor (distinct from the event-log sequence). `inputs` carries NO credential material (`runner-credential-non-transit`). |
+| `self-hosted-runner-result-frame.schema.json` | `self-hosted-runner.md` (RFC 0122) | DRAFT — the runner's answer to a dispatch: `{runId, stepId, seq, output}`, persisted as a normal step record (replay reads persistence, never re-dispatches). Closed shape (`runner-credential-non-transit`); `output` is fenced `<UNTRUSTED>` before re-entering an agent loop (`runner-output-untrusted-transport`). |
+| `self-hosted-runner-registration.schema.json` | `self-hosted-runner.md` (RFC 0122) | DRAFT — the per-subject runtime record for a registered runner: `{runnerId, subject, capabilities:{providers?,models?,tools?}}`. `subject` is the run's owning RFC 0048 principal; capability-match filters subject FIRST. Runtime state — MUST NOT appear on `/.well-known/openwop`. |
+| `budget-policy.schema.json` | `budget-policy.md` (RFC 0084) | The reserved `budget` run-options shape — `maxTokens`/`maxCostUsd`/`maxToolCalls`/`maxRetries`/`modelAllow[]`/`modelDeny[]`/`thresholdPercent`/`onExhaustion`. Enforceable per-run spend governance; wall-time/iterations delegated to RFC 0058 (`additionalProperties:false`). Content-free events; no pricing on the wire (`budget-no-pricing-leak`). |
+| `tool-descriptor.schema.json` | `tool-catalog.md` (RFC 0078) | Portable read-only description of one tool unifying the five tool surfaces (node-pack/workflow/mcp/connector/host-extension) — stable `toolId`, source, I/O schemas, auth/egress/approval requirements, replay policy, and `safetyTier` (`exec` ⇒ `host-extension`, RFC 0069). Returned by `GET /v1/tools`; secret-free (SR-1). |
+| `compact-tool-descriptor.schema.json` | `tool-catalog.md` §compact (RFC 0112) | Lossy model-facing projection of `ToolDescriptor` returned by `GET /v1/tools?view=compact` (`{ tools: [] }` envelope) when the host advertises `toolCatalog.compactView`. Keeps `toolId`/`source`/`safetyTier` (+ optional `title`/`description`/`inputSchema`), drops the heavy fields, and bounds any `inputSchema` to a self-contained structural subset (top-level object; no `$ref`/`oneOf`/`allOf`/`anyOf`/`not`/`patternProperties`/`dependentSchemas`). Secret-free (SR-1); `exec` ⇒ `host-extension`. |
+| `suspend-request.schema.json` | `interrupt.md` | `InterruptPayload` with 8 `kind` discriminators (approval, clarification, external-event, custom, conversation.start, conversation.exchange, conversation.close, low-confidence) |
+| `workflow-chain-pack-manifest.schema.json` | `workflow-chain-packs.md` + RFC 0013 | Manifest for workflow-chain packs (`kind: "workflow-chain"`) — pre-configured DAG fragments expanded inline at workflow-author time. Peer to `node-pack-manifest.schema.json`; disjoint via the `kind` discriminator. |
+| `workflow-definition.schema.json` | `channels-and-reducers.md` + `node-packs.md` | DAG of nodes + edges + triggers + variables + channels |
+| `certification-bundle-v2.schema.json` | `profiles.md` + RFC 0148 §C | Certification bundle v2 — per-requirement dispositions instead of pass/fail/skip file lists. `blocked` is a REQUIRED total because `blocked: 0` asserted differs from `blocked` unstated, and `assertionCount` makes an `executed-pass` that ran nothing visible in the artifact |
+| `workload-identity.schema.json` | `auth.md` + RFC 0154 §A/§B | Verified workload identity + delegated actor chain. Closed by design: raw certificates, tokens, proofs, and credentials MUST NOT enter these objects — `subject` is opaque and `proofRef`/`thumbprintRef` are digest references, because these objects reach events, spans, and audit records |
+| `compensation-policy.schema.json` | `compensation.md` §B + RFC 0151 | The reserved `settings.compensation` workflow key — WHEN an unwind starts (`triggers`, closed: `node-failure`/`run-cancel`/`cap-breach`/`operator-request`) and HOW it runs (`orderingModel`, `retry`/`timeoutMs` defaults, `exhaustedDisposition`, escalate-only `approvalScope`, `onParentCancel`). Authored, not per-run; `additionalProperties:false`. A non-advertising host MUST refuse it with `capability_required` rather than accept a policy it will never honour |
+| `workspace-file.schema.json` | `agent-workspace.md` + `RFCS/0059` | RFC 0059 — a versioned workspace file (`{path, content, version, etag, updatedAt}`); response of `GET/PUT /v1/host/workspace/files/{path}`. |
+| `workspace-file-create.schema.json` | `agent-workspace.md` + `RFCS/0059` | RFC 0059 — `PUT /v1/host/workspace/files/{path}` request body (content + optional contentType; path from the URL, version/etag host-assigned). |
+
+## Validating against the schemas
+
+### TypeScript / Node
+
+```typescript
+import Ajv2020 from 'ajv/dist/2020';
+import addFormats from 'ajv-formats';
+import schema from './run-event.schema.json';
+
+const ajv = new Ajv2020({ allErrors: true, strict: false });
+addFormats(ajv);
+const validate = ajv.compile(schema);
+
+if (!validate(myEvent)) {
+  console.error(validate.errors);
+}
+```
+
+### Python
+
+```python
+import json
+import jsonschema
+
+schema = json.load(open('run-event.schema.json'))
+jsonschema.validate(my_event, schema)  # raises ValidationError on failure
+```
+
+## Cross-reference
+
+- **Conformance test suite (P2-F4)** — black-box tests that fixture-validate against these schemas.
+- **Reference SDKs (P2-F3)** — generate types via `quicktype` or `json-schema-to-typescript`.
+- **OpenAPI 3.1 YAML** — references these schemas via `$ref` instead of inlining.
+
+## Open gaps
+
+| # | Gap | Owner |
+|---|---|---|
+| JS1 | Per-`RunEventType` payload schemas — done (2026-04-26: `run-event-payloads.schema.json` covers all 38 variants in ~15 shape families). Top-level `run-event.schema.json` `payload` stays permissive for forward-compat; consumers MAY pin strict validation via `$defs.<typeId>`. | ✅ |
+| JS2 | `Capabilities` schema — done (2026-04-26: `capabilities.schema.json` lifted from `Capabilities.ts`) | ✅ |
+| JS3 | `RunOptions` schema (configurable + tags + metadata) — done (2026-04-26: `run-options.schema.json` lifted from `run-options.md`) | ✅ |
+| JS4 | Channel-write event payload schema — done (2026-04-26: `channel-written-payload.schema.json` lifted from channels-and-reducers.md §Channel write event) | ✅ |
+| JS5 | Error-envelope schema — done (2026-04-26: `error-envelope.schema.json` hoisted from inline OpenAPI) | ✅ |
+| JS6 | `RunSnapshot` schema — done (2026-04-26: `run-snapshot.schema.json` hoisted from inline OpenAPI) | ✅ |
+
+## Versioning
+
+Schemas are versioned via `$id` URL (`/spec/v1/`). Breaking changes go to `/spec/v2/`. Non-breaking additions stay on v1 with `$comment` notes documenting added fields.

package/schemas/a2a-task-state.schema.json

@@ -0,0 +1,78 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/a2a-task-state.schema.json",
+  "title": "A2ATaskState",
+  "description": "RFC 0100 §2. The durable, persisted projection of an A2A `Task` an OpenWOP host keeps per backing run when it advertises `capabilities.a2a.durableTasks: true` — durable for the run's whole lifecycle (surviving caller disconnect, host restart within retention, and HITL pauses) so `tasks/get` returns live state after a disconnect. It is the persisted form of the `a2a-integration.md` §\"State projection (forward)\" mapping, NOT a new mapping. Content-free of run inputs/outputs/artifacts/credential material (SR-1 / `a2a-integration.md` trust boundary) — artifacts project to A2A `Artifact`s over the A2A transport, not into this record.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["taskId", "runId", "state", "updatedAt"],
+  "properties": {
+    "taskId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The A2A Task.id. MUST equal the backing OpenWOP `runId` (a2a-integration.md §2 — 'the returned runId becomes the A2A Task.id')."
+    },
+    "runId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The backing OpenWOP run. Bound 1:1 to `taskId`."
+    },
+    "contextId": {
+      "type": "string",
+      "description": "The A2A context_id (carried as the run tag `a2a:ctx_*` per a2a-integration.md §2)."
+    },
+    "state": {
+      "type": "string",
+      "enum": ["submitted", "working", "input-required", "auth-required", "completed", "failed", "canceled", "rejected"],
+      "description": "The A2A 0.3 JSON-RPC wire form (lowercase-hyphen — a2a-integration.md §'Wire-shape spelling drift'). Projected from `run.status` per a2a-integration.md §'State projection (forward)': pending→submitted, running→working, paused→working, waiting-approval/waiting-input→input-required, completed→completed, failed→failed, cancelled→canceled. `auth-required` is carried for reverse-direction fidelity only; the forward projection never sets it (openwop has no native auth interrupt — a2a-integration.md drift point #3)."
+    },
+    "interruptKind": {
+      "type": "string",
+      "enum": ["approval", "clarification"],
+      "description": "Present iff `state == 'input-required'`. Disambiguates a2a-integration.md drift point #2 (both approval + clarification project to INPUT_REQUIRED) — carried in `Task.metadata.openwop.interrupt.kind`, the `metadata.openwop.*` shape the doc's Future-work asks to codify."
+    },
+    "updatedAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "When the projected state last changed."
+    },
+    "pushConfig": { "$ref": "#/$defs/PushConfig" }
+  },
+  "$defs": {
+    "PushConfig": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["url"],
+      "description": "RFC 0100 §4. A caller-registered A2A push-notification config for this Task.",
+      "properties": {
+        "url": {
+          "type": "string",
+          "format": "uri",
+          "description": "Caller-registered push target. The host MUST validate it through the RFC 0093 webhook-egress SSRF guard before any push (no private/loopback/link-local target) — SECURITY invariant `a2a-push-egress-ssrf`."
+        },
+        "tokenFingerprint": {
+          "type": "string",
+          "maxLength": 32,
+          "description": "MAY — a truncated/salted digest of the caller's push-auth token (NEVER the raw token; same SR-1 rule as RFC 0083's `secretFingerprint`). The A2A push HMAC details (A2A §4.3.3) stay inside the A2A layer per a2a-integration.md."
+        }
+      }
+    }
+  },
+  "examples": [
+    {
+      "taskId": "run_x",
+      "runId": "run_x",
+      "contextId": "ctx_42",
+      "state": "input-required",
+      "interruptKind": "approval",
+      "updatedAt": "2026-06-13T19:00:00Z",
+      "pushConfig": { "url": "https://caller.example.com/a2a/push", "tokenFingerprint": "a1b2c3d4e5f6" }
+    },
+    {
+      "taskId": "run_y",
+      "runId": "run_y",
+      "state": "completed",
+      "updatedAt": "2026-06-13T19:05:00Z"
+    }
+  ]
+}

package/schemas/a2ui-surface-delta-frame.schema.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/a2ui-surface-delta-frame.schema.json",
+  "title": "A2uiSurfaceDeltaFrame",
+  "description": "RFC 0114. A HOST-SIDE TRANSPORT frame carrying an RFC 6902 (JSON-Patch) delta over a recorded `ui.a2ui-surface` envelope (RFC 0102). Delivered ONLY over the run event stream (`GET /v1/runs/{runId}/events`) to a subscriber that negotiated `?a2uiDelta=1`; every other consumer (the event-log read, replay, `:fork`, any non-negotiating subscriber) receives the materialized FULL surface. This is NOT a recorded-envelope shape: the canonical `ui.a2ui-surface.schema.json` envelope is UNCHANGED and always full. The consumer applies the `patch` to the surface last delivered under `surfaceRef`, then re-validates the result against the closed `catalogVersion` catalog before render (the same fail-closed validation a full surface receives, RFC 0102 §1); on ANY apply/validation failure it falls back to store-without-render and the host re-materializes the full surface.",
+  "type": "object",
+  "required": ["surfaceRef", "catalogVersion", "patch"],
+  "additionalProperties": false,
+  "properties": {
+    "surfaceRef": {
+      "type": "string",
+      "description": "REQUIRED — the recorded `ui.a2ui-surface` envelope id this delta patches. The consumer applies `patch` to the surface last delivered under this ref.",
+      "minLength": 1
+    },
+    "catalogVersion": {
+      "type": "string",
+      "description": "REQUIRED — the A2UI catalog version. MUST equal the referenced full surface's `catalogVersion`; a catalog-version change MUST start from a fresh full surface, never a delta.",
+      "minLength": 1
+    },
+    "patch": {
+      "type": "array",
+      "minItems": 1,
+      "description": "REQUIRED — a non-empty RFC 6902 (JSON-Patch) document applied over the surface last delivered under `surfaceRef`. The `test` op is EXCLUDED (a fire-and-forget transport frame cannot act on a failed conditional); `move`/`copy` are permitted but OPTIONAL to support.",
+      "items": {
+        "type": "object",
+        "required": ["op", "path"],
+        "additionalProperties": false,
+        "properties": {
+          "op": {
+            "enum": ["add", "remove", "replace", "move", "copy"],
+            "description": "RFC 6902 operation. `test` is deliberately excluded."
+          },
+          "path": {
+            "type": "string",
+            "description": "RFC 6901 JSON-Pointer into the target surface."
+          },
+          "from": {
+            "type": "string",
+            "description": "RFC 6901 JSON-Pointer source for `move`/`copy`."
+          },
+          "value": {
+            "description": "The value for `add`/`replace`. Walked by the SR-1 redaction harness exactly like a full-surface value (RFC 0114)."
+          }
+        }
+      }
+    }
+  }
+}

package/schemas/agent-deployment-transition.schema.json

@@ -0,0 +1,49 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/agent-deployment-transition.schema.json",
+  "title": "AgentDeploymentTransition",
+  "description": "RFC 0082 §E. The request body of POST /v1/agents/{agentId}/deployments — a deployment state-transition request. The host authorizes it fail-closed against the RFC 0049 `deploy:*` scope, runs any configured RFC 0051 approvalGate, enforces the RFC 0081 eval evidence when the gate requires it, and on success emits the matching `deployment.*` event and returns the updated `agent-deployment.schema.json` record. Carries no manifest body or credential material (SR-1).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "transition"],
+  "properties": {
+    "version": {
+      "type": "string",
+      "maxLength": 64,
+      "description": "The concrete agent-definition version the transition targets (matches `AgentManifest.version`)."
+    },
+    "transition": {
+      "type": "string",
+      "enum": ["promote", "pause", "deprecate", "rollback", "adjust-canary"],
+      "description": "The lifecycle operation. `promote`: advance toward production (draft→test→staged→active) into `toState`. `pause`: active→paused. `deprecate`: active→deprecated. `rollback`: active→rolled-back, restoring a prior version. `adjust-canary`: change the active version's `canaryPercent`. Legal transitions + the seven-state machine are normative in `agent-deployment.md` §C."
+    },
+    "toState": {
+      "type": "string",
+      "enum": ["draft", "test", "staged", "active", "paused", "deprecated", "rolled-back"],
+      "description": "MAY. The target lifecycle state for a `promote` transition. A host MUST reject a transition into a state it does not advertise in `capabilities.agents.deployment.states`."
+    },
+    "channel": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "description": "MAY. The named deployment channel this transition targets (e.g. `stable`). The version becomes resolvable by `AgentRef.channel` = this value (RFC 0082 §A/§B)."
+    },
+    "canaryPercent": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 100,
+      "description": "MAY. For `promote` to `active` or `adjust-canary`, the share of channel traffic this version takes. A host advertising `capabilities.agents.deployment.canary: false` MUST reject any value < 100."
+    },
+    "evalRunId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "MAY. The RFC 0081 eval run whose `EvalSummary.passed` the gate verifies before emitting `deployment.promoted` (the §E evidence). Required when the target `approvalGate` is configured with `requiredEval`; an unmet eval gate is rejected with `eval_gate_unmet`."
+    },
+    "reason": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512,
+      "description": "MAY. A short redaction-safe reason label (NOT free-text content), surfaced on `deployment.rolled-back.reason`. Same posture as `run.dead_lettered.reason`."
+    }
+  }
+}

package/schemas/agent-deployment.schema.json

@@ -0,0 +1,54 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/agent-deployment.schema.json",
+  "title": "AgentDeployment",
+  "description": "RFC 0082 §C. A per-(agentId, version) deployment record: the host-runtime lifecycle state of one version of a manifest agent (RFC 0003/0070), distinct from the immutable AgentManifest (which is the pack-distribution descriptor) and from the registry's published semver tags (which version EXISTS, not which version SERVES). Holds the deployment `state`, the named `channels` that resolve to this version, the canary traffic share, the rollback pointer, and the provenance (`evalRunId`/`approvalGateId`) of the last transition. Content-free of any manifest body or credential material (SR-1). The record itself is host-internal; this schema is the canonical wire shape a host exposes via GET /v1/agents/{agentId}/deployments (the endpoint lands at Active → Accepted per RFC 0082 §Conformance).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["agentId", "version", "state"],
+  "properties": {
+    "agentId": {
+      "type": "string",
+      "minLength": 3,
+      "maxLength": 256,
+      "description": "The deployed agent's id (matches `AgentManifest.agentId` / `AgentRef.agentId`)."
+    },
+    "version": {
+      "type": "string",
+      "maxLength": 64,
+      "description": "The concrete agent-definition version this record governs (matches `AgentManifest.version`). A deployment record is per-(agentId, version); a `@channel` reference resolves to exactly one such version per the RFC 0082 §B pin."
+    },
+    "state": {
+      "type": "string",
+      "enum": ["draft", "test", "staged", "active", "paused", "deprecated", "rolled-back"],
+      "description": "RFC 0082 §C lifecycle state. `draft`: authored, not yet evaluated. `test`: undergoing eval (RFC 0081). `staged`: eval-passed, awaiting production promotion. `active`: serving (optionally at `canaryPercent < 100`). `paused`: temporarily withdrawn, recoverable. `deprecated`: sunset — no new traffic, existing pins honored. `rolled-back`: superseded; `rollbackPointer` names the version that replaced it. Legal transitions: draft→test→staged→active (promotion); active↔paused (operational); active→deprecated (terminal); active→rolled-back (recovery, with `rollbackPointer`)."
+    },
+    "canaryPercent": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 100,
+      "description": "MAY. For an `active` version, the share (0–100) of channel traffic the §B pin draw assigns to THIS version; the remainder goes to the prior `active` version on the same channel. Absent ⇒ 100 (full traffic). A host advertising `agents.deployment.canary: false` MUST reject any value < 100. The per-run draw outcome is the recorded-fact `resolvedAgentVersion` (RFC 0082 §B) — never re-rolled on replay."
+    },
+    "rollbackPointer": {
+      "type": "string",
+      "maxLength": 64,
+      "description": "MAY. For a `rolled-back` version, the version that was restored to `active` in its place (the recovery target). Absent for non-rolled-back records."
+    },
+    "channels": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1 },
+      "description": "MAY. The named deployment channels (e.g. `stable`, `canary`) that resolve to this version. A version MAY be on more than one channel (RFC 0082 UQ#4 — a promoted-to-`stable` version is also resolvable by the reserved `latest` channel = highest active semver). Channel names are host-advertised in `capabilities.agents.deployment.channels`."
+    },
+    "evalRunId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "MAY. The RFC 0081 eval run whose `EvalSummary.passed` gated the last promotion into this state (the §E evidence). Content-free reference, not the eval body."
+    },
+    "approvalGateId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "MAY. The RFC 0051 `approvalGate` that authorized the last transition (the §E human gate). Content-free reference."
+    }
+  }
+}

package/schemas/agent-eval-suite.schema.json

@@ -0,0 +1,140 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/agent-eval-suite.schema.json",
+  "title": "AgentEvalSuite",
+  "description": "RFC 0081 §A. A portable, host-agnostic evaluation suite for a manifest agent (RFC 0003/0070): the tasks, the expected outputs or rubrics, the deterministic tool/memory fixtures, the allowed model classes, and the pass/fail thresholds that answer \"is this agent good enough to deploy?\". Distributed inside a pack tarball and referenced by URI exactly like `systemPromptRef` / `handoff.*SchemaRef` (RFC 0003 §C/§D) — NOT embedded in `AgentManifest`. A host advertising `capabilities.agents.evalSuite.supported: true` executes a suite as an eval run (a `mode: \"eval\"` projection over `POST /v1/runs`, RFC 0081 §B) and terminates with an `eval-summary.schema.json` scorecard. The suite carries NO secret material and NO host-internal identifiers (it is authored offline and shipped in a signed pack).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["suiteId", "version", "modes", "tasks"],
+  "properties": {
+    "suiteId": {
+      "type": "string",
+      "pattern": "^[a-z0-9.-]+\\.evals\\.[a-z0-9-]+$",
+      "description": "Globally unique suite identifier in the `<scope>.<org>.evals.<name>` convention (e.g. `core.openwop.evals.support-resolver`), mirroring the pack `<scope>.<author>.<pack>` namespace (RFC 0003). The `.evals.` infix distinguishes a suite from an agent/pack id."
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
+      "description": "SemVer of the suite. A suite version is pinned on an eval run (carried on `eval.started.suiteVersion` and `eval-summary.suiteVersion`) so a regression comparison (§D `regression` mode) is between like versions."
+    },
+    "targetAgentId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "MAY. The `AgentManifest.id` this suite is authored for. Absent ⇒ the suite is agent-agnostic and MAY be pointed at any `agentId` at run time (the run request carries the `agentId`). When present, a host SHOULD reject an eval run whose target `agentId` differs, unless the caller explicitly overrides."
+    },
+    "modes": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "type": "string", "enum": ["golden", "rubric", "adversarial", "regression", "live-shadow"] },
+      "description": "The eval modes this suite exercises (RFC 0081 §D closed vocabulary). `golden`: exact / contains / json-match against each task's `expected`. `rubric`: a host-chosen judge scores against weighted criteria (nondeterministic — a recorded-fact score). `adversarial`: tasks probe for unsafe / jailbreak behavior; `safetyFindings` is the primary output. `regression`: re-run against a new agent/model/prompt version and diff scores vs a `baselineRunId` (composes RFC 0054 `:diff`). `live-shadow`: run against LIVE tools/memory instead of `fixtures` — the only mode that bypasses fixture injection; explicitly nondeterministic. A run MUST request only modes the suite declares here AND the host advertises (`capabilities.agents.evalSuite.modes`); an unadvertised mode is rejected at run-create with `400 validation_error`."
+    },
+    "allowedModels": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string", "enum": ["reasoning", "writing", "coding", "research", "classification", "general"] },
+      "description": "MAY. The `AgentManifest.modelClass` values (RFC 0002) the suite is valid for. Absent ⇒ valid for any class. A host SHOULD record the `evaluatedModelClass` on the summary so a score is interpreted against the model it was produced with."
+    },
+    "thresholds": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "MAY. The pass/fail bar for the suite. A task or the aggregate `passed` flag is computed against these. Absent ⇒ the host's default bar (the summary still carries raw scores).",
+      "properties": {
+        "passScore": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1,
+          "description": "The minimum aggregate score (0.0–1.0) for `EvalSummary.passed: true`."
+        },
+        "maxCostUsd": {
+          "type": "number",
+          "minimum": 0,
+          "description": "MAY. The maximum total cost (summed from RFC 0026 `provider.usage`) for a passing run. A run that exceeds it MUST NOT report `passed: true` even if `passScore` is met."
+        },
+        "maxP95LatencyMs": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "MAY. The maximum p95 per-task latency for a passing run."
+        }
+      }
+    },
+    "tasks": {
+      "type": "array",
+      "minItems": 1,
+      "description": "The eval tasks. Each is executed as one child agent invocation (the RFC 0077 `agent.invocation.*` bracket + the existing `agent.*` / `provider.usage` events), scored, and reported via a per-task `eval.scored` event + an `EvalSummary` entry.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["taskId", "input", "expected"],
+        "properties": {
+          "taskId": {
+            "type": "string",
+            "pattern": "^[a-z0-9][a-z0-9-]*$",
+            "description": "Suite-unique task identifier (kebab-case). Carried verbatim on `eval.scored.taskId` and the per-task summary entry."
+          },
+          "input": {
+            "description": "The run input for the task, validated against the agent's input schema by the host. An opaque object/value — content is task-defined."
+          },
+          "expected": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["kind"],
+            "description": "How the task is scored. `golden`: deterministic match against `match`. `rubric`: a judge scores against weighted `rubric` criteria.",
+            "properties": {
+              "kind": { "type": "string", "enum": ["golden", "rubric"], "description": "Scoring mode for this task. A suite declaring a non-`golden`/`rubric` `modes` entry (e.g. `adversarial`) still scores each task via one of these two `kind`s." },
+              "match": {
+                "type": "object",
+                "additionalProperties": false,
+                "description": "Present when `kind: \"golden\"`. The deterministic expectation.",
+                "properties": {
+                  "strategy": { "type": "string", "enum": ["exact", "contains", "json-match"], "description": "`exact`: stringified output equals `value`. `contains`: output contains `value`. `json-match`: output JSON-deep-equals `value` (key order / whitespace insensitive)." },
+                  "value": { "description": "The expected value for the strategy. Opaque." }
+                },
+                "required": ["strategy", "value"]
+              },
+              "rubric": {
+                "type": "array",
+                "minItems": 1,
+                "description": "Present when `kind: \"rubric\"`. Weighted criteria a judge scores the output against; the task score is the weighted sum of met criteria, normalized to 0.0–1.0. Judge selection + scoring is host-internal (nondeterministic — the score is a recorded fact).",
+                "items": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["criterion", "weight"],
+                  "properties": {
+                    "criterion": { "type": "string", "minLength": 1, "description": "A human-readable scoring criterion (e.g. \"cites the 30-day refund window\")." },
+                    "weight": { "type": "number", "minimum": 0, "maximum": 1, "description": "Relative weight of this criterion (criteria weights SHOULD sum to 1.0 across the task)." }
+                  }
+                }
+              }
+            }
+          },
+          "fixtures": {
+            "type": "object",
+            "additionalProperties": false,
+            "description": "MAY. Deterministic substitutes for live tool/memory I/O so a `golden`/`regression` eval is reproducible. When present, the eval host MUST inject `toolResponses` in place of live tool calls and seed `memorySeed` before the invocation. The `live-shadow` mode is the explicit exception — it ignores `fixtures` and runs against live tools/memory.",
+            "properties": {
+              "toolResponses": {
+                "type": "array",
+                "description": "Canned tool results keyed by tool invocation, injected in place of live tool calls.",
+                "items": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["tool"],
+                  "properties": {
+                    "tool": { "type": "string", "minLength": 1, "description": "The `<scope>:<tool-id>` (RFC 0077 `toolAllowlist` / RFC 0078) the response stands in for." },
+                    "response": { "description": "The canned result the host returns for that tool. Opaque." }
+                  }
+                }
+              },
+              "memorySeed": {
+                "type": "array",
+                "description": "Memory entries seeded into the agent's read snapshot before the invocation (RFC 0004 `MemoryAdapter` shape). Tenant-scoped + SR-1-redacted on the host side exactly like any memory write.",
+                "items": { "type": "object" }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}